已合并
libxml2修复CVE-2026-0992 #150
limin创建于 2月26日
libxml2修复CVE-2026-0992 #150
已合并
共 2 个文件变更+49-1
| @@ -0,0 +1,47 @@ | |||
| 1 | +From e890f56551af26984249aa901bc0790012c7b296 Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Daniel Garcia Moreno <daniel.garcia@suse.com> | ||
| 3 | +Date: Fri, 19 Dec 2025 11:02:18 +0100 | ||
| 4 | +Subject: [PATCH] catalog: Ignore repeated nextCatalog entries | ||
| 5 | + | ||
| 6 | +This patch makes the catalog parsing to ignore repeated entries of | ||
| 7 | +nextCatalog with the same value. | ||
| 8 | + | ||
| 9 | +Fix https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019 | ||
| 10 | +--- | ||
| 11 | + catalog.c | 17 +++++++++++++++++ | ||
| 12 | + 1 file changed, 17 insertions(+) | ||
| 13 | + | ||
| 14 | +diff --git a/catalog.c b/catalog.c | ||
| 15 | +index 4d84a6ae8..c6602f976 100644 | ||
| 16 | +--- a/catalog.c | ||
| 17 | ++++ b/catalog.c | ||
| 18 | + xmlParseXMLCatalogNode(xmlNodePtr cur, xmlCatalogPrefer prefer, | ||
| 19 | + BAD_CAST "delegateURI", BAD_CAST "uriStartString", | ||
| 20 | + BAD_CAST "catalog", prefer, cgroup); | ||
| 21 | + } else if (xmlStrEqual(cur->name, BAD_CAST "nextCatalog")) { | ||
| 22 | ++ xmlCatalogEntryPtr prev = parent->children; | ||
| 23 | ++ | ||
| 24 | + entry = xmlParseXMLCatalogOneNode(cur, XML_CATA_NEXT_CATALOG, | ||
| 25 | + BAD_CAST "nextCatalog", NULL, | ||
| 26 | + BAD_CAST "catalog", prefer, cgroup); | ||
| 27 | ++ /* Avoid duplication of nextCatalog */ | ||
| 28 | ++ while (prev != NULL) { | ||
| 29 | ++ if ((prev->type == XML_CATA_NEXT_CATALOG) && | ||
| 30 | ++ (xmlStrEqual (prev->URL, entry->URL)) && | ||
| 31 | ++ (prev->prefer == entry->prefer) && | ||
| 32 | ++ (prev->group == entry->group)) { | ||
| 33 | ++ if (xmlDebugCatalogs) | ||
| 34 | ++ xmlGenericError(xmlGenericErrorContext, | ||
| 35 | ++ "Ignoring repeated nextCatalog %s\n", entry->URL); | ||
| 36 | ++ xmlFreeCatalogEntry(entry, NULL); | ||
| 37 | ++ entry = NULL; | ||
| 38 | ++ break; | ||
| 39 | ++ } | ||
| 40 | ++ prev = prev->next; | ||
| 41 | ++ } | ||
| 42 | + } | ||
| 43 | + if (entry != NULL) { | ||
| 44 | + if (parent != NULL) { | ||
| 45 | +-- | ||
| 46 | +2.34.1 | ||
| 47 | + | ||
| @@ -240,7 +240,8 @@ def do_patch(args, target_dir): | |||
| 240 | "Backport-CVE-2025-6021-tree-Fix-integer-overflow-in-xmlBuildQName-c.patch", | 240 | "Backport-CVE-2025-6021-tree-Fix-integer-overflow-in-xmlBuildQName-c.patch", |
| 241 | "Backport-CVE-2025-6170-Fix-potential-buffer-overflow-of-interactive-shell.patch", | 241 | "Backport-CVE-2025-6170-Fix-potential-buffer-overflow-of-interactive-shell.patch", |
| 242 | "Fix-CVE-2025-49794-CVE-2025-49796-memory-safety-issues-in-xmlSchematronReportOutput.patch", | 242 | "Fix-CVE-2025-49794-CVE-2025-49796-memory-safety-issues-in-xmlSchematronReportOutput.patch", |
| 243 | - "Fix-CVE-2026-0990-catalog-prevent-inf-recursion-in-xmlCatalogXMLResolveURI.patch" | 243 | + "Fix-CVE-2026-0990-catalog-prevent-inf-recursion-in-xmlCatalogXMLResolveURI.patch", |
| 244 | + "Fix-CVE-2026-0992-catalog-Ignore-repeated-nextCatalog-entries.patch" | ||
| 244 | ] | 245 | ] |
| 245 | 246 | ||
| 246 | for patch in patch_file: | 247 | for patch in patch_file: |